Questions practices ask

How is this different from compliance software?

Compliance software gives your team templates, a checklist and reminders, and your team does the work. We do the work with you: we write the plan, draft the policies, chase the vendor agreements, track the training, manage your Google Workspace, and show you the proof.

And because we administer your Google Workspace, we can set up and check the things software can only ask you about.

Do we still need our IT company?

Yes, and we are glad you have one. We run your compliance program and your Google Admin console: accounts, groups, security settings, email authentication and monitoring. Your IT company looks after computers, phones, printers and your network, and your staff themselves, including when someone can’t sign in. We give them Google’s Help Desk Admin role so they can reset passwords. We configure device policy. We do not support devices.

Having IT support of your own is one of our requirements, because without it your staff would bring every problem to us anyway. How we work with your IT company

Do you touch our EHR?

No. We never need access to your EHR. Our work is your compliance program and your Google Workspace: the risk assessment, policies, vendor agreements, training records, configuration and the evidence. Each quarter we remind your practice manager to review the EHR’s own access report, and record whether it was done.

Google Workspace can still hold patient information in email and Drive, and we administer it, so we act as your business associate and sign a business associate agreement with you.

Doesn’t Google keep our logs?

For six months. On every edition, Google keeps your Google Workspace activity logs for six months, then deletes them. HIPAA asks you to review that activity regularly and to keep your compliance records for six years. If you learn in March that an account was misused last summer, the logs that show what it touched are already gone unless someone saved them. We save them before Google deletes them, and put a copy in your own Shared Drive every quarter.

Is this a HIPAA certification?

No, because there is no such thing. HHS, the agency that enforces HIPAA, does not certify, endorse or approve anyone.

What we give you is a compliance program run with you, a Google Workspace configured to an agreed standard, a count of how many of the 27 Security Rule safeguards are in place, and the evidence that the work was done.

Who is responsible for our compliance?

Legally, your practice is. HIPAA puts that on the practice, and it can’t be handed to an outside company. In practice, we carry most of the load.

Of the 27 safeguards in the Security Rule, we handle 15 ourselves. For the other 12, your leadership decides or your team acts, and we tell them exactly what to do, follow up until it is done, and record that it happened. Your Security Official makes the decisions. We make sure nothing gets dropped.

What if we are on Business Standard?

You would move up to Business Plus before setup starts. Two safeguards, automatic logoff and six-year retention, cannot be set up on Business Standard or Starter at all. We coordinate the change with your Google partner, and you pay Google for the edition, not us.

We recommend Enterprise Standard but do not require it. If you stay on Business Plus, our Business Plus page sets out what you go without and how we make up for it.

What happens after hours?

Our hours are 9 to 5 in your own time zone. After hours, the one-page guide we give you at setup lets your own administrator suspend an account in about a minute, and we take it from there the next business morning.

What do we keep if we leave?

Your records. Your evidence pack lives in your own Shared Drive from the first day, so your policies, reports, reviews and records stay where they are. You always keep at least one administrator account of your own; we never hold the only keys.

When we part ways, we remove our own access and return or destroy anything we hold, as our business associate agreement requires.

What does it cost?

$997 a month for up to 50 Google Workspace seats, and $10 a month for each seat above 50, plus a one-time setup fee, starting at $4,997, quoted for your practice. The first term is twelve months, then month to month. What you pay your vendors, such as Google, is separate. See pricing